fix(backend): store token expiry as UTC instead of server local time

backend/backend/graphene/mutations/environment.py

@@ -49,7 +49,7 @@
     ServiceTokenType,
     UserTokenType,
 )
-from datetime import datetime
+from datetime import datetime, timezone as dt_timezone
 
 
 class EnvironmentInput(graphene.InputObjectType):
@@ -694,7 +694,7 @@ def mutate(
             )
 
             if expiry is not None:
-                expires_at = datetime.fromtimestamp(expiry / 1000)
+                expires_at = datetime.fromtimestamp(expiry / 1000, tz=dt_timezone.utc)
             else:
                 expires_at = None
 
@@ -821,7 +821,7 @@ def mutate(
         )
 
         if expiry is not None:
-            expires_at = datetime.fromtimestamp(expiry / 1000)
+            expires_at = datetime.fromtimestamp(expiry / 1000, tz=dt_timezone.utc)
         else:
             expires_at = None
 

backend/backend/graphene/mutations/lockbox.py

@@ -1,7 +1,7 @@
 from api.models import Lockbox
 from backend.graphene.types import LockboxType
 import graphene
-from datetime import datetime
+from datetime import datetime, timezone as dt_timezone
 
 
 class LockboxInput(graphene.InputObjectType):
@@ -19,7 +19,7 @@ class Arguments:
     @classmethod
     def mutate(cls, root, info, input):
         if input.expiry is not None:
-            expires_at = datetime.fromtimestamp(input.expiry / 1000)
+            expires_at = datetime.fromtimestamp(input.expiry / 1000, tz=dt_timezone.utc)
         else:
             expires_at = None
 

backend/backend/graphene/mutations/service_accounts.py

@@ -25,7 +25,7 @@
 from api.utils.audit_logging import log_audit_event, get_actor_info_from_graphql
 from api.utils.rest import get_resolver_request_meta
 from backend.graphene.types import ServiceAccountTokenType, ServiceAccountType
-from datetime import datetime
+from datetime import datetime, timezone as dt_timezone
 from django.conf import settings
 
 
@@ -450,7 +450,7 @@ def mutate(
         _check_sa_permission(user, service_account, "create", "ServiceAccountTokens")
 
         if expiry is not None:
-            expires_at = datetime.fromtimestamp(expiry / 1000)
+            expires_at = datetime.fromtimestamp(expiry / 1000, tz=dt_timezone.utc)
         else:
             expires_at = None
 
@@ -588,7 +588,7 @@ def mutate(cls, root, info, service_account_id, name, expiry=None):
         wrapped_share_b = wrap_share_hex(share_b, wrap_key)
 
         if expiry is not None:
-            expires_at = datetime.fromtimestamp(expiry / 1000)
+            expires_at = datetime.fromtimestamp(expiry / 1000, tz=dt_timezone.utc)
         else:
             expires_at = None
 

backend/ee/authentication/scim/graphene/queries.py

@@ -1,7 +1,7 @@
 from graphql import GraphQLError
 from api.models import OrganisationMember, SCIMEvent, SCIMToken
 from api.utils.access.permissions import user_has_permission, user_is_org_member
-from datetime import datetime
+from datetime import datetime, timezone as dt_timezone
 
 
 def resolve_scim_tokens(root, info, organisation_id):
@@ -52,10 +52,10 @@ def resolve_scim_events(
     qs = SCIMEvent.objects.filter(organisation_id=organisation_id)
 
     if start is not None:
-        qs = qs.filter(timestamp__gte=datetime.fromtimestamp(start / 1000))
+        qs = qs.filter(timestamp__gte=datetime.fromtimestamp(start / 1000, tz=dt_timezone.utc))
 
     if end is not None:
-        qs = qs.filter(timestamp__lte=datetime.fromtimestamp(end / 1000))
+        qs = qs.filter(timestamp__lte=datetime.fromtimestamp(end / 1000, tz=dt_timezone.utc))
 
     if event_types:
         # Frontend sends uppercase enum values (e.g. USER_CREATED),